'Vitriol' Rootkit to Demo at MS Blue Hat Hacker Summit

WEBINAR:On-Demand

Microsoft's twice-yearly Blue Hat summit will kick off with a demo of a virtualization-based rootkit that can be used to defeat the company's PatchGuard technology.

Microsoft's twice-yearly Blue Hat hacker summit, running Oct. 26-27, will kick off later this week with a demo of a virtual machine rootkit that can potentially be used to defeat the controversial PatchGuard technology.

Dino Dai Zovi, a principal at penetration-testing outfit Matasano Security, has been invited to Microsoft's Redmond, Wash., campus to showcase a hardware VM-based rootkit called Vitriol that piggybacks on Intel's VT-x virtualization extension.

Zovi, an expert on exploitation techniques, 802.11 wireless attacks and operating system kernel security, will demo the rootkit at the conference, to which select members of the hacking community are invited to brainstorm security issues with Microsoft employees and executives.

The Vitriol presentation is an expansion of a talk given by Zovi (here as a PDF) at the Black Hat Briefings in Las Vegas in August, and will include a technical explanation of how Intel's VT-x extensions can allow malicious hackers to install a "rootkit hypervisor" that invisibly runs the original operating system in a virtual machine.

Zovi plans to demonstrate how the Vitriol rootkit can migrate a running operating system into a hardware virtual machine on the fly and install itself as a rootkit hypervisor. The malicious code becomes inaccessible to the operating system, maintaining stealth and controlling access to the malware.

Microsoft's own Cybersecurity and Systems Management Research Group has also created a proof-of-concept rootkit called SubVirt that exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation.

Check out eWEEK.com's for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's Weblog.

Advertiser Disclosure:
Some of the products that appear on this site are from companies from which QuinStreet receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. QuinStreet does not include all companies or all types of products available in the marketplace.